linux/drivers/pinctrl
Chen-Yu Tsai 10098709b4 pinctrl: sunxi: Correct number of IRQ banks on H6 main pin controller
The H6 main pin controller has four banks of interrupt-triggering pins.
The driver as originally submitted only specified three, but had pin
descriptions referencing a fourth bank. This results in a out-of-bounds
access into .irq_array of struct sunxi_pinctrl. This however did not
result in a crash until v4.20, with commit a66d972465 ("devres: Align
data[] to ARCH_KMALLOC_MINALIGN"), which changed the alignment of memory
region returned by devm_kcalloc(). The increase likely moved the
out-of-bounds access into the next, unmapped page.

With KASAN on, the bug is quite clear:

    BUG: KASAN: slab-out-of-bounds in sunxi_pinctrl_init_with_variant+0x49c/0x12b8
    Write of size 4 at addr ffff80002c680280 by task swapper/0/1

    CPU: 2 PID: 1 Comm: swapper/0 Not tainted 5.0.0-rc1-00016-gc480a5e6a077 #3
    Hardware name: OrangePi Lite2 (DT)
    Call trace:
     dump_backtrace+0x0/0x220
     show_stack+0x14/0x20
     dump_stack+0xac/0xd4
     print_address_description+0x60/0x25c
     kasan_report+0x14c/0x1ac
     __asan_store4+0x80/0xa0
     sunxi_pinctrl_init_with_variant+0x49c/0x12b8
     h6_pinctrl_probe+0x18/0x20
     platform_drv_probe+0x6c/0xc8
     really_probe+0x244/0x4b0
     driver_probe_device.part.4+0x11c/0x164
     __driver_attach+0x120/0x190
     bus_for_each_dev+0xe8/0x158
     driver_attach+0x30/0x40
     bus_add_driver+0x308/0x318
     driver_register+0xbc/0x1d0
     __platform_driver_register+0x7c/0x88
     h6_pinctrl_driver_init+0x18/0x20
     do_one_initcall+0xd4/0x208
     kernel_init_freeable+0x230/0x2c8
     kernel_init+0x10/0x108
     ret_from_fork+0x10/0x1c

    Allocated by task 1:
     kasan_kmalloc.part.0+0x4c/0x100
     kasan_kmalloc+0xc4/0xe8
     kasan_slab_alloc+0x14/0x20
     __kmalloc_track_caller+0x130/0x238
     devm_kmalloc+0x34/0xd0
     sunxi_pinctrl_init_with_variant+0x1d8/0x12b8
     h6_pinctrl_probe+0x18/0x20
     platform_drv_probe+0x6c/0xc8
     really_probe+0x244/0x4b0
     driver_probe_device.part.4+0x11c/0x164
     __driver_attach+0x120/0x190
     bus_for_each_dev+0xe8/0x158
     driver_attach+0x30/0x40
     bus_add_driver+0x308/0x318
     driver_register+0xbc/0x1d0
     __platform_driver_register+0x7c/0x88
     h6_pinctrl_driver_init+0x18/0x20
     do_one_initcall+0xd4/0x208
     kernel_init_freeable+0x230/0x2c8
     kernel_init+0x10/0x108
     ret_from_fork+0x10/0x1c

    Freed by task 0:
    (stack is not available)

    The buggy address belongs to the object at ffff80002c680080
     which belongs to the cache kmalloc-512 of size 512
    The buggy address is located 0 bytes to the right of
     512-byte region [ffff80002c680080, ffff80002c680280)
    The buggy address belongs to the page:
    page:ffff7e0000b1a000 count:1 mapcount:0 mapping:ffff80002e00c780 index:0xffff80002c683c80 compound_mapcount: 0
    flags: 0x10200(slab|head)
    raw: 0000000000010200 ffff80002e003a10 ffff80002e003a10 ffff80002e00c780
    raw: ffff80002c683c80 0000000000100001 00000001ffffffff 0000000000000000
    page dumped because: kasan: bad access detected

    Memory state around the buggy address:
     ffff80002c680180: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
     ffff80002c680200: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    >ffff80002c680280: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
		       ^
     ffff80002c680300: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc
     ffff80002c680380: fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc fc

Correct the number of IRQ banks so there are no more mismatches.

Fixes: c8a8309049 ("pinctrl: sunxi: add support for the Allwinner H6 main pin controller")
Cc: <stable@vger.kernel.org>
Signed-off-by: Chen-Yu Tsai <wens@csie.org>
Tested-by: Neil Armstrong <narmstrong@baylibre.com>
Acked-by: Maxime Ripard <maxime.ripard@bootlin.com>
Signed-off-by: Linus Walleij <linus.walleij@linaro.org>
2019-01-22 10:52:39 +01:00
..
actions pinctrl: actions: Add Actions Semi S700 pinctrl driver 2018-11-19 14:12:34 +01:00
aspeed pinctrl: aspeed: Wrap -Woverride-init with cc-option 2018-12-16 01:22:38 +01:00
bcm pinctrl: bcm: ns: support updated DT binding as syscon subnode 2018-12-21 11:45:49 +01:00
berlin pinctrl: Convert to using %pOFn instead of device_node.name 2018-08-29 14:05:36 +02:00
cirrus pinctrl: madera: Fix uninitialized variable bug in madera_mux_set_mux 2018-10-12 11:14:38 +02:00
freescale pinctrl: freescale: Break dependency on SOC_IMX8MQ for i.MX8MQ 2018-12-27 10:39:27 +01:00
intel pinctrl: cherryview: fix Strago DMI workaround 2019-01-21 13:05:42 +01:00
mediatek pinctrl: mediatek: fix Kconfig build errors for moore core 2019-01-11 15:22:49 +01:00
meson Pin control bulk changes for the v4.21 kernel cycle: 2019-01-01 13:19:16 -08:00
mvebu pinctrl: Include <linux/gpio/driver.h> nothing else 2018-09-14 15:10:57 +02:00
nomadik pinctrl: nomadik: Fix debugfs 2018-10-03 09:10:52 +02:00
nuvoton pinctrl: nuvoton: check for devm_kasprintf() failure 2018-12-05 22:55:04 +01:00
pxa pinctrl: pxa: pxa2xx: add missing MODULE_DESCRIPTION/AUTHOR/LICENSE 2017-11-30 14:42:04 +01:00
qcom Pin control bulk changes for the v4.21 kernel cycle: 2019-01-01 13:19:16 -08:00
samsung pinctrl: Use of_node_name_eq for node name comparisons 2018-12-14 16:03:03 +01:00
sh-pfc pinctrl: sh-pfc: Make pinmux_cfg_reg.var_field_width[] variable-length 2018-12-18 11:25:56 +01:00
sirf pinctrl: Include <linux/gpio/driver.h> nothing else 2018-09-14 15:10:57 +02:00
spear pinctrl: Include <linux/gpio/driver.h> nothing else 2018-09-14 15:10:57 +02:00
sprd pinctrl: sprd: Use define directive for sprd_pinconf_params values 2018-11-09 10:20:47 +01:00
stm32 pinctrl: stm32: protect configuration registers with a hwspinlock 2018-11-19 13:17:46 +01:00
sunxi pinctrl: sunxi: Correct number of IRQ banks on H6 main pin controller 2019-01-22 10:52:39 +01:00
tegra pinctrl: tegra: do not export tegra_pinctrl_probe 2018-09-20 08:15:16 -07:00
ti pinctrl: Convert to using %pOFn instead of device_node.name 2018-08-29 14:05:36 +02:00
uniphier pinctrl: uniphier: constify uniphier_pinctrl_socdata 2018-12-21 11:18:08 +01:00
vt8500 pinctrl: Include <linux/gpio/driver.h> nothing else 2018-09-14 15:10:57 +02:00
zte treewide: devm_kzalloc() -> devm_kcalloc() 2018-06-12 16:19:22 -07:00
Kconfig pinctrl: ocelot: Add dependency on HAS_IOMEM 2018-12-22 11:15:04 +01:00
Makefile pinctrl: Add RZ/A2 pin and gpio controller 2018-11-23 09:30:27 +01:00
core.c pinctrl: core: make sure strcmp() doesn't get a null parameter 2018-10-01 13:46:13 +02:00
core.h pinctrl: core: Remove broken remove_last group and pinmux functions 2018-07-17 10:49:49 +02:00
devicetree.c pinctrl: Support stopping deferred probe after initcalls 2018-07-10 17:22:35 +02:00
devicetree.h pinctrl: core: Use delayed work for hogs 2017-01-03 09:26:16 +01:00
pinconf-generic.c pinctrl: Add skew-delay pin config and bindings 2017-11-08 13:49:45 +01:00
pinconf.c pinctrl: Change to use DEFINE_SHOW_ATTRIBUTE macro 2018-12-07 11:11:10 +01:00
pinconf.h pinctrl: move const qualifier before struct 2017-08-14 15:01:02 +02:00
pinctrl-amd.c pinctrl: pinctrl-amd: simplify getting .driver_data 2018-11-05 09:33:32 +01:00
pinctrl-amd.h pinctrl/amd: fix gpio irq level in debugfs 2018-07-29 22:20:15 +02:00
pinctrl-artpec6.c pinctrl: artpec-6: Add smaller groups for uarts 2018-03-01 17:04:09 +01:00
pinctrl-as3722.c pinctrl: Include <linux/gpio/driver.h> nothing else 2018-09-14 15:10:57 +02:00
pinctrl-at91-pio4.c pinctrl: pinctrl-at91-pio4: simplify getting .driver_data 2018-11-05 09:33:32 +01:00
pinctrl-at91.c pinctrl: Include <linux/gpio/driver.h> nothing else 2018-09-14 15:10:57 +02:00
pinctrl-at91.h
pinctrl-axp209.c pinctrl: axp209: Fix NULL pointer dereference after allocation 2018-08-10 23:12:43 +02:00
pinctrl-coh901.c pinctrl: Include <linux/gpio/driver.h> nothing else 2018-09-14 15:10:57 +02:00
pinctrl-coh901.h License cleanup: add SPDX GPL-2.0 license identifier to files with no license 2017-11-02 11:10:55 +01:00
pinctrl-da850-pupd.c Merge branch 'ib-pinctrl-genprops' into devel 2017-01-26 15:27:54 +01:00
pinctrl-digicolor.c pinctrl: Include <linux/gpio/driver.h> nothing else 2018-09-14 15:10:57 +02:00
pinctrl-falcon.c pinctrl: Include <linux/gpio/driver.h> nothing else 2018-09-14 15:10:57 +02:00
pinctrl-gemini.c pinctrl: gemini: Fix up TVC clock group 2018-10-10 21:05:35 +02:00
pinctrl-ingenic.c This is the 4.19-rc6 release 2018-10-01 13:20:45 +02:00
pinctrl-lantiq.c pinctrl: Convert to using %pOFn instead of device_node.name 2018-08-29 14:05:36 +02:00
pinctrl-lantiq.h pinctrl: update my email address 2016-12-30 09:17:02 +01:00
pinctrl-lpc18xx.c pinctrl: lpc18xx: Use define directive for PIN_CONFIG_GPIO_PIN_INT 2018-11-09 10:23:58 +01:00
pinctrl-max77620.c pinctrl: max77620: Use define directive for max77620_pinconf_param values 2018-11-09 10:02:22 +01:00
pinctrl-mcp23s08.c pinctrl: mcp23s08: spi: Fix regmap allocation for mcp23s18 2019-01-21 14:18:15 +01:00
pinctrl-ocelot.c pinctrl: ocelot: add MSCC Jaguar2 support 2018-12-21 11:50:48 +01:00
pinctrl-oxnas.c gpio: Move irqdomain into struct gpio_irq_chip 2017-11-08 14:06:21 +01:00
pinctrl-palmas.c pinctrl: palmas: Delete an error message for a failed memory allocation in palmas_pinctrl_probe() 2018-01-03 08:46:49 +01:00
pinctrl-pic32.c gpio: Move irqdomain into struct gpio_irq_chip 2017-11-08 14:06:21 +01:00
pinctrl-pic32.h pinctrl: pinctrl-pic32: Add PIC32 pin control driver 2016-02-05 23:54:47 +01:00
pinctrl-pistachio.c pinctrl: Include <linux/gpio/driver.h> nothing else 2018-09-14 15:10:57 +02:00
pinctrl-rk805.c pinctrl: Add pinctrl driver for the RK805 PMIC 2017-08-21 08:54:46 +01:00
pinctrl-rockchip.c pinctrl: rockchip: add rk3188 routes to switch between nand and emmc 2018-11-17 13:18:53 +01:00
pinctrl-rza1.c pinctrl: rza1: Handle devm_kasprintf() failure cases 2018-12-18 11:25:56 +01:00
pinctrl-rza2.c pinctrl: Add RZ/A2 pin and gpio controller 2018-11-23 09:30:27 +01:00
pinctrl-rzn1.c pinctrl: rzn1: Fix of_get_child_count() error check 2018-12-04 10:33:49 +01:00
pinctrl-single.c pinctrl: Convert to using %pOFn instead of device_node.name 2018-08-29 14:05:36 +02:00
pinctrl-st.c pinctrl: Convert to using %pOFn instead of device_node.name 2018-08-29 14:05:36 +02:00
pinctrl-sx150x.c pinctrl: sx150x: handle failure case of devm_kstrdup 2018-12-07 13:22:47 +01:00
pinctrl-tb10x.c pinctrl: tb10x: constify pinconf_ops, pinctrl_ops, and pinmux_ops structures 2017-08-22 14:41:40 +02:00
pinctrl-u300.c headers: separate linux/mod_devicetable.h from linux/platform_device.h 2018-07-07 17:52:26 +02:00
pinctrl-utils.c pinctrl: utils: Delete an error message for a failed memory allocation in pinctrl_utils_add_map_configs() 2018-01-03 08:46:53 +01:00
pinctrl-utils.h pinctrl: Rename pinctrl_utils_dt_free_map to pinctrl_utils_free_map 2016-04-01 15:06:36 +02:00
pinctrl-xway.c pinctrl: xway: fix gpio-hog related boot issues 2018-12-17 23:11:18 +01:00
pinctrl-zynq.c pinctrl: zynq: Use define directive for PIN_CONFIG_IO_STANDARD 2018-11-09 10:25:17 +01:00
pinmux.c pinctrl: Change to use DEFINE_SHOW_ATTRIBUTE macro 2018-12-07 11:11:10 +01:00
pinmux.h pinctrl: core: Remove broken remove_last group and pinmux functions 2018-07-17 10:49:49 +02:00